How do I add a remote MCP server with a Bearer token to OpenCode?

In `opencode.json`, add an entry under `mcp` with `type: "remote"`, the `url`, `oauth: false`, and `headers: { "Authorization": "Bearer {env:COMMA_API_TOKEN}" }`.

Why does OpenCode try to OAuth into Comma?

OpenCode attempts OAuth on remote servers unless `oauth` is set to `false`. Comma authenticates with a scoped `comma_sk_` token, so disable it.

Do I need to run anything locally for Comma's MCP server?

No. Comma's MCP server is hosted at https://commareports.com/api/mcp over Streamable HTTP. The config entry and a `comma_sk_` token are the whole setup — unless you use the `mcp-remote` bridge, which runs via `npx`.

Is Comma free to use from OpenCode?

Yes. Publishing reports, inviting commenters and keeping revisions are free. Routines — scheduled runs Comma hosts — are the paid part.

Use Comma with OpenCode

OpenCode lives in the terminal, which is exactly where a finished analysis goes to be forgotten. Attach Comma as a remote MCP server and the agent can turn that analysis into a link your team reviews in a browser.

Add Comma to OpenCode

Global: ~/.config/opencode/opencode.json. Project: opencode.json at the repository root.

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "comma": {
      "type": "remote",
      "url": "https://commareports.com/api/mcp",
      "enabled": true,
      "oauth": false,
      "headers": {
        "Authorization": "Bearer {env:COMMA_API_TOKEN}"
      }
    }
  }
}

Replace comma_sk_… with a token from Settings → API tokens → New token on Comma (or export it as COMMA_API_TOKEN where the snippet reads an env var). The default scopes — reports:write, comments:read, comments:write — cover publishing and review.

Check the connection with opencode mcp list; opencode mcp debug comma shows the handshake if it fails.

OpenCode gotchas

Set "oauth": false. OpenCode tries OAuth discovery on remote servers by default; Comma uses a static Bearer token, so skip it.
{env:NAME} syntax — OpenCode's variable form, not ${NAME}.
The top-level key is mcp, not mcpServers, and each server needs "type": "remote".

What the agent can do

Capability	Tools
Publish a report	`create_report`, `update_report`, `create_report_from_url`
Find existing reports	`list_reports`, `search_reports`, `get_report`, `read_report`
Leave / reply to comments	`add_comment`, `reply_to_comment`, `set_comment_status`, `list_comments`
Ask for review, share	`request_review`, `set_report_sharing`, `get_report_signoffs`
Manage assets	`upload_report_asset`, `list_report_assets`, `delete_report_asset`

OpenCode picks the tool from the request — there are no OpenCode-specific commands to learn.

A workflow that sticks

Ask OpenCode to write up the work as a self-contained HTML report and publish it to Comma. It calls create_report and returns a link.
Send the link. Reviewers open a rendered page and leave comments anchored to the exact line, cell or chart they mean — no account needed to read a public link.
Next session, ask OpenCode to address the comments. It reads the threads with list_comments, ships a revision with update_report (same URL), replies, and resolves them.

Reports belong to your workspace, not to the agent. A report published from OpenCode can be revised tomorrow from Claude Code or Cursor, and the link people bookmarked keeps working.

Token shape

Read from COMMA_API_TOKEN via {env:…}, so opencode.json is safe to commit.
Scoped — you choose which actions it can take when you create it.
Revocable in one click from Settings → API tokens; revocation applies immediately to the REST API, the MCP server and any routines the token created.
Rate-limited per token.

Details in API tokens → and Scoped tokens for AI agents →.

Try it

Add the entry, generate a token, restart OpenCode, and ask for a report on something you worked on today. Then leave a comment on it and ask the agent what it sees.

Generate a token →